CVE-2021-22189

Starting with version 13.7 the Gitlab CE/EE editions were affected by a security issue related to the validation of the certificates for the Fortinet OTP that could result in authentication issues...

CVE-2021-22189

Starting with version 13.7 the Gitlab CE/EE editions were affected by a security issue related to the validation of the certificates for the Fortinet OTP that could result in authentication issues...

PT-2021-14900 · Gitlab +1 · Gitlab Ce/Ee +2

Name of the Vulnerable Software and Affected Versions: Gitlab CE/EE versions 13.7 and later Description: The issue is related to the validation of certificates for the Fortinet OTP, which could result in authentication issues. Recommendations: For Gitlab CE/EE versions 13.7 and later, update to a...

CVE-2021-22189: Improper Certificate Validation

Starting with version 13.7 the Gitlab CE/EE editions were affected by a security issue related to the validation of the certificates for the Fortinet OTP that could result in authentication issues...

Fortinet FortiProxy SSL VPN security vulnerability

Fortinet FortiProxy SSL VPN is a software application from Fortinet. It provides an intrusion detection feature. A security vulnerability exists in FortiProxy SSL VPN that can be exploited by an attacker to obtain the credentials of logged in SSL VPN users...

Gitlab Trust Management Vulnerability

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A trust management issue vulnerability exists in Gitlab...

FortiProxy SSL VPN user credential plaintext storage

...

FortiOS Path Traversal Credential Gatherer

Fortinet FortiOS versions 5.4.6 to 5.4.12, 5.6.3 to 5.6.7 and 6.0.0 to 6.0.4 are vulnerable to a path traversal vulnerability within the SSL VPN web portal which allows unauthenticated attackers to download FortiOS system files through specially crafted HTTP requests. This module exploits this...

ASUS RT-AX86U Buffer Overflow (CVE-2020-36109)

A buffer overflow vulnerability exists in Fortinet ASUS RT-AX86U. Successful exploitation of this vulnerability could result in a denial of service or execution of arbitrary code into the affected system...

Fortinet FortiOS SSL VPN Buffer Overflow (CVE-2018-13381)

A buffer overflow vulnerability exists in Fortinet FortiOS. Successful exploitation of this vulnerability could result in a denial of service or execution of arbitrary code into the affected system...

VulnCheck KEV: CVE-2018-13374

Fortinet FortiOS and FortiADC contain an improper access control vulnerability that allows attackers to obtain the LDAP server login credentials configured in FortiGate by pointing a LDAP server connectivity test request to a rogue LDAP server...

CVE-2020-6649

An insufficient session expiration vulnerability in FortiNet's FortiIsolator version 2.0.1 and below may allow an attacker to reuse the unexpired admin user session IDs to gain admin privileges, should the attacker be able to obtain that session ID via other, hypothetical attacks...

Session fixation

An insufficient session expiration vulnerability in FortiNet's FortiIsolator version 2.0.1 and below may allow an attacker to reuse the unexpired admin user session IDs to gain admin privileges, should the attacker be able to obtain that session ID via other, hypothetical attacks...

CVE-2020-6649

An insufficient session expiration vulnerability in FortiNet's FortiIsolator version 2.0.1 and below may allow an attacker to reuse the unexpired admin user session IDs to gain admin privileges, should the attacker be able to obtain that session ID via other, hypothetical attacks...

CVE-2020-6649

CVE-2020-6649 affects FortiIsolator 2.0.1 and earlier. Insufficient session expiration could let an attacker reuse unexpired admin session IDs to gain admin privileges if the session ID is obtained (as noted in Fortinet advisory FG-IR-20-011). Affected version lineage: FortiIsolator 2.0.1 and bel...

CVE-2020-6649

An insufficient session expiration vulnerability in FortiNet's FortiIsolator version 2.0.1 and below may allow an attacker to reuse the unexpired admin user session IDs to gain admin privileges, should the attacker be able to obtain that session ID via other, hypothetical attacks...

Fortinet FortiWeb Cross-Site Scripting Vulnerability (CNVD-2021-12664)

Fortinet FortiWeb is a Web application layer firewall from the U.S. company Fita Fortinet, which can block threats such as cross-site scripting, SQL injection, cookie poisoning, schema poisoning and other attacks to ensure the security of Web applications and protect sensitive database content. A...

Fortinet FortiWeb Stack Buffer Overflow Vulnerability

Fortinet FortiWeb is a Web application layer firewall from the U.S. company Fita Fortinet, which can block threats such as cross-site scripting, SQL injection, cookie poisoning, schema poisoning and other attacks to ensure the security of Web applications and protect sensitive database content. A...

Fortinet FortiWeb cross-site scripting vulnerability

Fortinet FortiWeb is a Web application layer firewall from the U.S. company Fita Fortinet, which can block threats such as cross-site scripting, SQL injection, cookie poisoning, schema poisoning and other attacks to ensure the security of Web applications and protect sensitive database content. A...

Fortinet FortiOS < 6.0.11 / 6.2 < 6.2.5 / 6.4 < 6.4.2 Information Disclosure (FG-IR-20-103)

The remote host is running a version of FortiOS prior to 6.0.11, 6.2.x prior to 6.2.5, or 6.4.x prior to 6.4.2. It is, therefore, affected by an information disclosure vulnerability. A remote, authenticated attacker can exploit this, by executing 'get vpn ssl monitor', in order to read the SSL VP...